tmpl1fhq7si[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
tmpl1fhq7si.exe
Size 277KB
Sample260522-vghv8aaz8m
SHA256 3809d1b0015c5f7ae1ee65ad0139191f72ed9d69b21f1719073e2805ce811dfd
MD5 c8d68322c6b1b5e8ee201d234833c79c
SHA1 f27c3933a73d13980bc9248251bacddf9ccbb86f
SHA512 efc985f39b7463fb7f277a6f83d6aab26e4cb6e3aacf0a1735ff08bb0877095d09aa0278e110db20fba2323a125f8f6ab4494321b889d46cb9910f6680567049
SSDEEP 6144:a1TnDzopfUxko17BX/ECry0Eya7dSYl0Od/P+9:a1TDeo59EgUgYl08+
TLSH
T16D54E0116F60A903CB71CE3799738CF75C2CAC385A6A27261AC0D97C351E77F602A679
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tmpl1fhq7si.exe

File Explorer

tmpl1fhq7si.exe

.exe 277KB

tmpl1fhq7si.exe

IMPHASH c57f5dd0091bc33bcaddd2a624fbf86d
SHA256 3809d1b0015c5f7ae1ee65ad0139191f72ed9d69b21f1719073e2805ce811dfd
MD5 c8d68322c6b1b5e8ee201d234833c79c
SHA1 f27c3933a73d13980bc9248251bacddf9ccbb86f
SHA512 efc985f39b7463fb7f277a6f83d6aab26e4cb6e3aacf0a1735ff08bb0877095d09aa0278e110db20fba2323a125f8f6ab4494321b889d46cb9910f6680567049
SSDEEP 6144:a1TnDzopfUxko17BX/ECry0Eya7dSYl0Od/P+9:a1TDeo59EgUgYl08+
TLSH
T16D54E0116F60A903CB71CE3799738CF75C2CAC385A6A27261AC0D97C351E77F602A679
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12615

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

gdi32

GetClipRgn TextOutW GetObjectW CreateSolidBrush ExtTextOutW Polygon SetBkMode CreateCompatibleDC CreateCompatibleBitmap GetTextExtentExPointW GetObjectType CreateRectRgnIndirect GetStockObject RoundRect CreatePen SetROP2 GetBkColor PtInRegion SetBkColor ExtCreatePen SelectClipRgn BitBlt SelectObject CombineRgn GetTextMetricsW GetDeviceCaps SetViewportOrgEx SetTextColor SetTextAlign DeleteDC CreateRectRgn GetTextExtentPoint32W CreateFontIndirectW DeleteObject

shlwapi

PathSetDlgItemPathW PathAppendW StrChrW StrRetToStrW PathCompactPathExW PathAddExtensionW PathRemoveFileSpecW ColorAdjustLuma

user32

GetSystemMetrics TabbedTextOutW SendMessageW LoadImageW DrawIconEx SetCapture EmptyClipboard CharUpperBuffW GetNextDlgTabItem LoadCursorW GetDC RegisterWindowMessageW IsWindow GetTopWindow MoveWindow GetSysColor SetCursor GetTabbedTextExtentW GetFocus GetClassNameW GetWindowTextLengthW PostQuitMessage InflateRect SetWindowTextW SetRectEmpty ReleaseDC IsDialogMessageW GetSystemMenu GetWindowThreadProcessId InvalidateRect GetClassInfoExW GetWindowRect ScreenToClient LoadBitmapW GetDlgCtrlID SetForegroundWindow IsRectEmpty IsIconic PostMessageW MessageBoxW SetMenuDefaultItem PtInRect ReleaseCapture EndDialog RedrawWindow DefWindowProcW DrawTextW CallWindowProcW UpdateWindow SetFocus ShowWindow GetActiveWindow AttachThreadInput OpenClipboard SetClipboardData EndPaint DispatchMessageW DrawStateW DestroyIcon SystemParametersInfoW GetWindowDC SendInput SetWindowsHookExW GetClientRect GetCursorPos AppendMenuW GetWindowTextW RegisterClassW IsWindowVisible BeginPaint GetClassInfoW FlashWindow GetGUIThreadInfo IsWindowEnabled DialogBoxParamW GetForegroundWindow CopyRect CharNextW MapWindowPoints GetMessageW PostThreadMessageW SetWindowLongW TranslateMessage CloseClipboard SetWindowPlacement DestroyWindow SetParent GetDesktopWindow KillTimer SetTimer EnableWindow GetKeyState GetWindowPlacement SetWindowPos GetWindow GetParent GetWindowLongW UnhookWindowsHookEx UnregisterClassA CallNextHookEx ExitWindowsEx PeekMessageW CreateWindowExW GetCapture MapDialogRect SetDlgItemTextW RegisterClassExW FindWindowExW CreateDialogParamW GetDlgItem IsCharAlphaNumericW DrawFocusRect OffsetRect

comctl32

ImageList_ReplaceIcon ImageList_Create ImageList_Draw ImageList_GetIcon InitCommonControlsEx ImageList_AddMasked ImageList_GetImageCount ImageList_Destroy _TrackMouseEvent

shell32

ShellExecuteExW SHGetSpecialFolderLocation SHGetMalloc SHGetDesktopFolder

msimg32

AlphaBlend TransparentBlt GradientFill

userenv

UnloadUserProfile

oleaut32

VariantCopyInd VariantTimeToSystemTime VariantClear VarBstrCmp LoadRegTypeLi SafeArrayGetLBound SafeArrayUnaccessData GetErrorInfo LoadTypeLi SysStringByteLen SystemTimeToVariantTime SysStringLen DispCallFunc VariantInit SafeArrayCopy SafeArrayUnlock SafeArrayAccessData SysAllocStringByteLen SysAllocString SafeArrayRedim SafeArrayCreate SysFreeString SafeArrayLock SafeArrayGetDim SysAllocStringLen SafeArrayGetVartype SafeArrayGetUBound SafeArrayDestroy

advapi32

RegQueryValueExW RegOpenKeyExA RegOpenKeyExW AdjustTokenPrivileges RegCreateKeyExW RegNotifyChangeKeyValue RegCloseKey LookupPrivilegeValueW OpenProcessToken RegSetValueExW RegQueryValueExA

kernel32

GetNumberFormatW HeapSize HeapFree SizeofResource RaiseException LocalAlloc GetCurrentThreadId WaitForSingleObject GlobalUnlock TerminateThread LeaveCriticalSection DeleteFileW lstrcpyW VirtualAlloc EnterCriticalSection IsDebuggerPresent OpenEventW GetDateFormatW DeleteCriticalSection WaitForMultipleObjects FindResourceW FindResourceExW SetLastError lstrcpynW GetDriveTypeW LoadResource LocalFree lstrcmpW GlobalAlloc UnhandledExceptionFilter CloseHandle FindFirstFileW GlobalFree GetCommandLineW FreeLibrary GetUserDefaultLangID HeapReAlloc FlushInstructionCache CreateWaitableTimerW SetUnhandledExceptionFilter CreateThread ResumeThread GetThreadLocale GetACP GetProcessHeap FormatMessageW LoadLibraryExW ExpandEnvironmentStringsA HeapDestroy CreateEventW lstrlenW IsProcessorFeaturePresent MulDiv lstrlenA FatalAppExitW LockResource GetSystemTimeAsFileTime SetWaitableTimer FindClose GetTimeFormatW WideCharToMultiByte FindNextFileW GetUserDefaultLCID VirtualFree lstrcmpiW HeapAlloc GetModuleHandleW GlobalLock GetTimeFormatA GetModuleHandleA

ole32

CLSIDFromString CoInitialize CreateStreamOnHGlobal CoRegisterClassObject OleRun CoUninitialize CoResumeClassObjects CLSIDFromProgID CoCreateInstance CoRevokeClassObject StringFromGUID2 CoInitializeSecurity

dbghelp

ImageRvaToSection GetTimestampForLoadedLibrary SymGetModuleInfo64 ImageNtHeader SymLoadModuleEx FindFileInPath SymGetModuleInfo SymInitialize

iedkcs32

CloseRASConnections

Name

.text

Size

89KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.Uklks

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.XYoPb

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.KDSy

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

6KB

Virtual Size

156KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

140KB

Virtual Size

140KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.NJacjN

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.TeiWDy

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eKJTS

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.yqEN

Size

512B

Virtual Size

428B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.koVO

Size

512B

Virtual Size

502B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.zXrek

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

tmpl1fhq7si.exe

gdi32

shlwapi

user32

comctl32

shell32

msimg32

userenv

oleaut32

advapi32

kernel32

ole32

dbghelp

iedkcs32

generic